fix Expressions like e²3 crashes mate-calcfix/#213

2 files changed, 14 insertions, 1 deletions

diff --git a/src/parser.c b/src/parser.c
index d60c142..2cce157 100644
--- a/src/parser.c
+++ b/src/parser.c
@@ -219,8 +219,13 @@ p_destroy_all_nodes(ParseNode* node)
     p_destroy_all_nodes(node->right);
     /* Don't call free for tokens, as they are allocated and freed in lexer. */
     /* WARNING: If node->value is freed elsewhere, please assign it NULL before calling p_destroy_all_nodes(). */
-    if(node->value)
+    /* Fix for crash in expressions like "e²3" where node->value may be invalid */
+    if(node->value && node->value != (void*)node->token)
+    {
+        /* Only free if value was dynamically allocated by parser functions */
+        /* Skip freeing if value points to token data or other non-malloc'd memory */
         free(node->value);
+    }
     free(node);
 }
 
diff --git a/src/test-mp-equation.c b/src/test-mp-equation.c
index 5d480df..1ccab9c 100644
--- a/src/test-mp-equation.c
+++ b/src/test-mp-equation.c
@@ -771,6 +771,14 @@ test_equations(void)
     //options.wordlen = 2;
     //test("¬01₂", "10₂", 0);
     //test("¬¬10₂", "10₂", 0);
+
+    /* Regression tests for crash bug with variable names + superscript + number */
+    /* These should return error instead of crashing (issue: e²3 should be invalid) */
+    test("e²3", "", PARSER_ERR_INVALID);
+    test("var²3", "", PARSER_ERR_UNKNOWN_VARIABLE);
+    test("x¹²3", "", PARSER_ERR_INVALID);
+    test("abc¹²³456", "", PARSER_ERR_UNKNOWN_VARIABLE);
+    test("test²²²1", "", PARSER_ERR_UNKNOWN_VARIABLE);
 }
 
 int